PT-2025-35191 · WordPress · Iats Online Forms
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
iATS Online Forms plugin for WordPress versions up to and including 1.2
Description
The iATS Online Forms plugin for WordPress is susceptible to time-based SQL Injection via the
order parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow authenticated attackers with Contributor-level access or higher to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database.Recommendations
Update iATS Online Forms plugin for WordPress to a version later than 1.2.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Iats Online Forms